How Sidona protects your bid data

Sidona Inc. operates the Platform on modern cloud infrastructure with defense-in-depth controls designed for B2B SaaS and procurement workloads.

No method of transmission or storage is 100% secure. We implement commercially reasonable safeguards but cannot guarantee absolute security. See our Terms of Service for related limitations.

Public-sector buyers and contractors increasingly ask where their data lives. Sidona hosts primary application databases and stored tender documents in cloud regions in the United States.

Authentication, payments, transactional email, and AI inference also involve subprocessors that process data in the United States or other jurisdictions. We contract for safeguards consistent with Canadian privacy law. See our Privacy Policy.

Your matching profile, chat questions and, on Premium, the company documents you upload (certificates, licences, insurance) are confidential customer data.

• No model training: Your profile, chat content and company documents are not used to train our own or publicly available AI models.
• Encrypted company documents: Each Premium document is encrypted with its own AES-256 key, wrapped by Google Cloud KMS, and stored in non-public storage. Only your account (and your company's members) can open it. Sidona staff cannot. Every upload, download and deletion is recorded in an access history you can view.
• Encrypted chat: Your document Q&A questions and answers are encrypted with an AES-256 key unique to your account, wrapped by Google Cloud KMS, so they can't be read from our database or its backups.
• Deleted when Premium ends: Documents are permanently deleted when you remove them, withdraw consent, downgrade or your Premium plan ends, and their keys are destroyed so backup copies can't be read.
• Tenant isolation: Your workspace data is logically separated from other customers.
• Purpose limitation: AI processing is performed to deliver Platform features — parsing, Q&A, matching, and compliance extraction — not for unrelated purposes.

Account security is managed through industry-standard authentication. Enterprise customers can deploy additional controls for larger bid teams.

Much of what Sidona aggregates — tender notices, award notices, and attached solicitation documents — is already published by governments for public access. We ingest from official federal, provincial, territorial, and US state sources. Your private uploads, notes, and bid responses remain separate from this public corpus and are protected as customer data.

Sidona maintains incident response procedures to detect, contain, and remediate security events. If we become aware of a breach affecting your personal information, we will notify affected users in accordance with applicable Canadian breach notification requirements, including PIPEDA.

To report a suspected security issue or vulnerability, contact us immediately via our Contact Page. Please include sufficient detail for our team to investigate.

Security is a shared responsibility. You agree to:

• Keep account credentials confidential and use strong, unique passwords.
• Enable multi-factor authentication when available.
• Limit deal room access to authorized team members only.
• Report suspected unauthorized access promptly.
• Maintain up-to-date security software on devices used to access the Platform.